Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-11-25 05:41:12 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 243519. Fix the crashtest so that it doesn't bomb out with a JS error without completing the actual test. And make it (and Acid3) actually pass without screwing up the frame tree.

Browse Source
This commit is contained in:
Robert O'Callahan 2008-09-06 22:21:37 +12:00
parent 895ed86080
commit 75d693298a
3 changed files with 38 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
layout/base/crashtests/243519-1.html
View File

@ -7,21 +7,24 @@
document.body.offsetTop;
document.documentElement.style.display = "table";
document.body.offsetTop;
document.documentElement..style.display = "";
document.documentElement.style.display = "";
document.body.offsetTop;
document.documentElement.style.position = "absolute";
document.body.offsetTop;
document.documentElement.style.display = "table";
document.body.offsetTop;
document.documentElement..style.display = "";
document.documentElement.style.display = "";
document.body.offsetTop;
document.documentElement.style.position = "fixed";
document.body.offsetTop;
document.documentElement.style.display = "table";
document.body.offsetTop;
document.documentElement..style.display = "";
document.documentElement.style.display = "";
document.documentElement.style.position = "";
document.body.offsetTop;
</script>
</body>
</html>

34
layout/base/nsCSSFrameConstructor.cpp
View File

@ -7563,8 +7563,19 @@ nsCSSFrameConstructor::ReconstructDocElementHierarchyInternal()
// FixedContainingBlock. Note that this has to be done before we call
// ClearPlaceholderFrameMap(), since RemoveFixedItems uses the
// placeholder frame map.
rv = RemoveFixedItems(state);
rv = RemoveFixedItems(state, docElementFrame);
if (NS_SUCCEEDED(rv)) {
nsPlaceholderFrame* placeholderFrame = nsnull;
if (docElementFrame &&
(docElementFrame->GetStateBits() & NS_FRAME_OUT_OF_FLOW)) {
// Get the placeholder frame now, before we tear down the
// placeholder frame map
placeholderFrame =
state.mFrameManager->GetPlaceholderFrameFor(docElementFrame);
NS_ASSERTION(placeholderFrame, "No placeholder for out-of-flow?");
}
// Clear the hash tables that map from content to frame and out-of-flow
// frame to placeholder frame
state.mFrameManager->ClearPrimaryFrameMap();
@ -7573,7 +7584,6 @@ nsCSSFrameConstructor::ReconstructDocElementHierarchyInternal()
if (docElementFrame) {
// Take the docElementFrame, and remove it from its parent.
// XXXbz So why can't we reuse ContentRemoved?
// Notify self that we will destroy the entire frame tree, this blocks
@ -7581,9 +7591,17 @@ nsCSSFrameConstructor::ReconstructDocElementHierarchyInternal()
// crash since we cleared the placeholder map above (bug 398982).
PRBool wasDestroyingFrameTree = mIsDestroyingFrameTree;
WillDestroyFrameTree();
// Remove the old document element hierarchy
rv = state.mFrameManager->RemoveFrame(docElementFrame->GetParent(),
GetChildListNameFor(docElementFrame), docElementFrame);
if (placeholderFrame) {
// Remove the placeholder frame first (XXX second for now) (so
// that it doesn't retain a dangling pointer to memory)
rv |= state.mFrameManager->RemoveFrame(placeholderFrame->GetParent(),
nsnull, placeholderFrame);
}
mIsDestroyingFrameTree = wasDestroyingFrameTree;
if (NS_FAILED(rv)) {
return rv;
@ -12838,7 +12856,9 @@ nsCSSFrameConstructor::ReframeContainingBlock(nsIFrame* aFrame)
return ReconstructDocElementHierarchyInternal();
}
nsresult nsCSSFrameConstructor::RemoveFixedItems(const nsFrameConstructorState& aState)
nsresult
nsCSSFrameConstructor::RemoveFixedItems(const nsFrameConstructorState& aState,
nsIFrame *aRootElementFrame)
{
nsresult rv=NS_OK;
@ -12846,6 +12866,12 @@ nsresult nsCSSFrameConstructor::RemoveFixedItems(const nsFrameConstructorState&
nsIFrame *fixedChild = nsnull;
do {
fixedChild = mFixedContainingBlock->GetFirstChild(nsGkAtoms::fixedList);
if (fixedChild == aRootElementFrame) {
// Skip the root element frame, if it happens to be fixed-positioned
// It will be explicitly removed later in
// ReconstructDocElementHierarchyInternal
fixedChild = fixedChild->GetNextSibling();
}
if (fixedChild) {
// Remove the placeholder so it doesn't end up sitting about pointing
// to the removed fixed frame.

3
layout/base/nsCSSFrameConstructor.h
View File

@ -1049,7 +1049,8 @@ private:
nsIFrame* aPrevSibling,
nsFrameItems& aFrameItems);
nsresult RemoveFixedItems(const nsFrameConstructorState& aState);
nsresult RemoveFixedItems(const nsFrameConstructorState& aState,
nsIFrame* aRootElementFrame);
// Find the right frame to use for aContent when looking for sibling
// frames for aTargetContent. If aPrevSibling is true, this